I have the following challenge: We have the web logs of a platform where people can download publications and we need to detect anomalies.
From time to time and only by chance we observe spikes in usage over a day or so, where there are many more downloads than usually. Often these spikes are caused by the same IP address or several from the same IP address range. Also, these requests are for the same publication (as identified by the same URL).
I now wonder how we can identify anomalies like this automatically. Taking into account that sometimes, an item is not downloaded for several days or weeks, so there is not necessarily a lot of "normal" download data available.
The business wants us to detect these anomalies, qualify them (are they fraudulent or legit) and exclude them from the overall results if fraudulent.
What would be the best approach to tackle this problem?